diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 019534a39716..8f425a01506c 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -44,6 +44,7 @@ android {
     packagingOptions {
         resources {
             excludes += "/META-INF/*"
+            excludes += "/META-INF/versions/**"
             excludes += "/org/bouncycastle/**"
             excludes += "/kotlin/**"
             excludes += "/kotlinx/**"
@@ -72,9 +73,9 @@ dependencies {
     implementation("com.github.topjohnwu:indeterminate-checkbox:1.0.7")
     implementation("com.github.topjohnwu:lz4-java:1.7.1")
     implementation("com.jakewharton.timber:timber:5.0.1")
-    implementation("org.bouncycastle:bcpkix-jdk18on:1.71")
+    implementation("org.bouncycastle:bcpkix-jdk18on:1.72")
     implementation("dev.rikka.rikkax.layoutinflater:layoutinflater:1.2.0")
-    implementation("dev.rikka.rikkax.insets:insets:1.2.0")
+    implementation("dev.rikka.rikkax.insets:insets:1.3.0")
     implementation("dev.rikka.rikkax.recyclerview:recyclerview-ktx:1.3.1")
     implementation("io.noties.markwon:core:4.6.2")
 
@@ -93,11 +94,11 @@ dependencies {
     implementation("com.squareup.okhttp3:logging-interceptor:${vOkHttp}")
     implementation("com.squareup.okhttp3:okhttp-dnsoverhttps:${vOkHttp}")
 
-    val vMoshi = "1.13.0"
+    val vMoshi = "1.14.0"
     implementation("com.squareup.moshi:moshi:${vMoshi}")
     kapt("com.squareup.moshi:moshi-kotlin-codegen:${vMoshi}")
 
-    val vRoom = "2.5.0-alpha03"
+    val vRoom = "2.5.0-rc01"
     implementation("androidx.room:room-runtime:${vRoom}")
     implementation("androidx.room:room-ktx:${vRoom}")
     kapt("androidx.room:room-compiler:${vRoom}")
@@ -111,7 +112,7 @@ dependencies {
     implementation("androidx.swiperefreshlayout:swiperefreshlayout:1.1.0")
     implementation("androidx.appcompat:appcompat:1.5.1")
     implementation("androidx.recyclerview:recyclerview:1.2.1")
-    implementation("androidx.fragment:fragment-ktx:1.5.4")
+    implementation("androidx.fragment:fragment-ktx:1.5.5")
     implementation("androidx.transition:transition:1.4.1")
     implementation("androidx.core:core-ktx:1.9.0")
     implementation("androidx.core:core-splashscreen:1.0.0")
diff --git a/app/shared/src/main/AndroidManifest.xml b/app/shared/src/main/AndroidManifest.xml
index 9d351b52fc04..0edea0fff5f6 100644
--- a/app/shared/src/main/AndroidManifest.xml
+++ b/app/shared/src/main/AndroidManifest.xml
@@ -1,6 +1,5 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools"
-    package="com.topjohnwu.shared"
     android:installLocation="internalOnly">
 
     <uses-permission android:name="android.permission.INTERNET" />
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index a7b4c0276661..0242a1d5bd82 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -2,13 +2,22 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
 
+    <permission
+        android:name="${applicationId}.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
+        android:protectionLevel="signature"
+        tools:node="remove" />
+
+    <uses-permission
+        android:name="${applicationId}.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
+        tools:node="remove" />
+
     <application
         android:name=".core.App"
         android:extractNativeLibs="true"
         android:icon="@drawable/ic_launcher"
         android:multiArch="true"
-        tools:remove="android:appComponentFactory"
-        tools:ignore="UnusedAttribute,GoogleAppIndexingWarning">
+        tools:ignore="UnusedAttribute,GoogleAppIndexingWarning"
+        tools:remove="android:appComponentFactory">
 
         <activity
             android:name=".ui.MainActivity"
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt b/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
index 7a1c4d151ffe..60a6b5123309 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt
@@ -131,7 +131,7 @@ abstract class MagiskInstallImpl protected constructor(
             }
 
             // Extract scripts
-            for (script in listOf("util_functions.sh", "boot_patch.sh", "addon.d.sh")) {
+            for (script in listOf("util_functions.sh", "boot_patch.sh", "addon.d.sh", "stub.apk")) {
                 val dest = File(installDir, script)
                 context.assets.open(script).writeTo(dest)
             }
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/utils/net/LollipopNetworkObserver.kt b/app/src/main/java/com/topjohnwu/magisk/core/utils/net/LollipopNetworkObserver.kt
index 161bde696eb6..6de99b2a6ea4 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/utils/net/LollipopNetworkObserver.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/utils/net/LollipopNetworkObserver.kt
@@ -1,14 +1,13 @@
 package com.topjohnwu.magisk.core.utils.net
 
-import android.annotation.TargetApi
 import android.content.Context
 import android.net.ConnectivityManager
 import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
+import android.os.Build
 import androidx.collection.ArraySet
 
-@TargetApi(21)
 open class LollipopNetworkObserver(
     context: Context,
     callback: ConnectionCallback
@@ -17,10 +16,13 @@ open class LollipopNetworkObserver(
     private val networkCallback = NetCallback()
 
     init {
-        val request = NetworkRequest.Builder()
-            .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-            .build()
-        manager.registerNetworkCallback(request, networkCallback)
+        val builder = NetworkRequest.Builder()
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+            builder.addCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
+        } else {
+            builder.addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+        }
+        manager.registerNetworkCallback(builder.build(), networkCallback)
     }
 
     @Suppress("DEPRECATION")
diff --git a/app/src/main/java/com/topjohnwu/magisk/core/utils/net/MarshmallowNetworkObserver.kt b/app/src/main/java/com/topjohnwu/magisk/core/utils/net/MarshmallowNetworkObserver.kt
index 8f6eebab1668..62b5baf3b3e8 100644
--- a/app/src/main/java/com/topjohnwu/magisk/core/utils/net/MarshmallowNetworkObserver.kt
+++ b/app/src/main/java/com/topjohnwu/magisk/core/utils/net/MarshmallowNetworkObserver.kt
@@ -1,5 +1,3 @@
-@file:Suppress("DEPRECATION")
-
 package com.topjohnwu.magisk.core.utils.net
 
 import android.annotation.TargetApi
@@ -32,7 +30,7 @@ class MarshmallowNetworkObserver(
 
     override fun getCurrentState() {
         callback(manager.getNetworkCapabilities(manager.activeNetwork)
-            ?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) ?: false)
+            ?.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED) ?: false)
     }
 
     private inner class IdleBroadcastReceiver: BroadcastReceiver() {
diff --git a/app/src/main/res/values-sw/strings.xml b/app/src/main/res/values-sw/strings.xml
new file mode 100644
index 000000000000..528440c1b8ba
--- /dev/null
+++ b/app/src/main/res/values-sw/strings.xml
@@ -0,0 +1,238 @@
+<resources>
+
+    <!--Sections-->
+    <string name="modules">Moduli</string>
+    <string name="superuser">Mtumiaji mkuu</string>
+    <string name="logs">Kumbukumbu</string>
+    <string name="settings">Mipangilio</string>
+    <string name="install">Sakinisha</string>
+    <string name="section_home">Nyumbanik</string>
+    <string name="section_theme">Mandhari</string>
+    <string name="denylist">DenyList</string>
+
+    <!--Home-->
+    <string name="no_connection">Hakuna muunganisho unaopatikana</string>
+    <string name="app_changelog">Kumbukumbu</string>
+    <string name="loading">Loading…</string>
+    <string name="update">Sasisha</string>
+    <string name="not_available">Haipatikani</string>
+    <string name="hide">Ficha</string>
+    <string name="home_package">Kifurushi</string>
+    <string name="home_app_title">Programu</string>
+
+    <string name="home_notice_content">Download Magisk ONLY from the official GitHub page. Files from unknown sources can be malicious!</string>
+    <string name="home_support_title">Support Us</string>
+    <string name="home_item_source">Source</string>
+    <string name="home_support_content">Magisk is, and always will be, free, and open source. You can however show us that you care by making a donation.</string>
+    <string name="home_installed_version">Installed</string>
+    <string name="home_latest_version">Latest</string>
+    <string name="invalid_update_channel">Invalid Update Channel</string>
+    <string name="uninstall_magisk_title">Uninstall Magisk</string>
+    <string name="uninstall_magisk_msg">All modules will be disabled/removed!\nRoot will be removed!\nAny internal storage unencrypted through the use of Magisk will be re-encrypted!</string>
+
+    <!--Install-->
+    <string name="keep_force_encryption">Preserve force encryption</string>
+    <string name="keep_dm_verity">Preserve AVB 2.0/dm-verity</string>
+    <string name="patch_vbmeta">Patch vbmeta in boot image</string>
+    <string name="recovery_mode">Recovery Mode</string>
+    <string name="install_options_title">Options</string>
+    <string name="install_method_title">Method</string>
+    <string name="install_next">Next</string>
+    <string name="install_start">Let\'s go</string>
+    <string name="manager_download_install">Press to download and install</string>
+    <string name="direct_install">Direct Install (Recommended)</string>
+    <string name="install_inactive_slot">Install to Inactive Slot (After OTA)</string>
+    <string name="install_inactive_slot_msg">Your device will be FORCED to boot to the current inactive slot after a reboot!\nOnly use this option after OTA is done.\nContinue?</string>
+    <string name="setup_title">Additional Setup</string>
+    <string name="select_patch_file">Select and Patch a File</string>
+    <string name="patch_file_msg">Select a raw image (*.img) or an ODIN tarfile (*.tar)</string>
+    <string name="reboot_delay_toast">Rebooting in 5 seconds…</string>
+    <string name="flash_screen_title">Installation</string>
+
+    <!--Superuser-->
+    <string name="su_request_title">Superuser Request</string>
+    <string name="touch_filtered_warning">Because an app is obscuring a Superuser request, Magisk can\'t verify your response</string>
+    <string name="deny">Deny</string>
+    <string name="prompt">Prompt</string>
+    <string name="grant">Grant</string>
+    <string name="su_warning">Grants full access to your device.\nDeny if you\'re not sure!</string>
+    <string name="forever">Forever</string>
+    <string name="once">Once</string>
+    <string name="tenmin">10 mins</string>
+    <string name="twentymin">20 mins</string>
+    <string name="thirtymin">30 mins</string>
+    <string name="sixtymin">60 mins</string>
+    <string name="su_allow_toast">%1$s was granted Superuser rights</string>
+    <string name="su_deny_toast">%1$s was denied Superuser rights</string>
+    <string name="su_snack_grant">Superuser rights of %1$s are granted</string>
+    <string name="su_snack_deny">Superuser rights of %1$s are denied</string>
+    <string name="su_snack_notif_on">Notifications of %1$s are enabled</string>
+    <string name="su_snack_notif_off">Notifications of %1$s are disabled</string>
+    <string name="su_snack_log_on">Logging of %1$s is enabled</string>
+    <string name="su_snack_log_off">Logging of %1$s is disabled</string>
+    <string name="su_revoke_title">Revoke?</string>
+    <string name="su_revoke_msg">Confirm to revoke %1$s Superuser rights</string>
+    <string name="toast">Toast</string>
+    <string name="none">None</string>
+
+    <string name="superuser_toggle_notification">Notifications</string>
+    <string name="superuser_toggle_revoke">Revoke</string>
+    <string name="superuser_policy_none">No apps have asked for Superuser permission yet.</string>
+
+    <!--Logs-->
+    <string name="log_data_none">You\'re log-free, try using your root apps more</string>
+    <string name="log_data_magisk_none">Magisk logs are empty, that\'s weird</string>
+    <string name="menuSaveLog">Save log</string>
+    <string name="menuClearLog">Clear log now</string>
+    <string name="logs_cleared">Log successfully cleared</string>
+    <string name="pid">PID: %1$d</string>
+    <string name="target_uid">Target UID: %1$d</string>
+
+    <!--SafetyNet-->
+
+    <!--MagiskHide-->
+    <string name="show_system_app">Show system apps</string>
+    <string name="show_os_app">Show OS apps</string>
+    <string name="hide_filter_hint">Filter by name</string>
+    <string name="hide_search">Search</string>
+
+    <!--Module-->
+    <string name="no_info_provided">(No info provided)</string>
+    <string name="reboot_userspace">Soft reboot</string>
+    <string name="reboot_recovery">Reboot to Recovery</string>
+    <string name="reboot_bootloader">Reboot to Bootloader</string>
+    <string name="reboot_download">Reboot to Download</string>
+    <string name="reboot_edl">Reboot to EDL</string>
+    <string name="module_version_author">%1$s by %2$s</string>
+    <string name="module_state_remove">Remove</string>
+    <string name="module_state_restore">Restore</string>
+    <string name="module_action_install_external">Install from storage</string>
+    <string name="update_available">Update Available</string>
+    <string name="suspend_text_riru">Module suspended because %1$s is enabled</string>
+    <string name="suspend_text_zygisk">Module suspended because %1$s is not enabled</string>
+    <string name="zygisk_module_unloaded">Zygisk module not loaded due to incompatibility</string>
+
+    <!--Settings-->
+    <string name="settings_dark_mode_title">Theme Mode</string>
+    <string name="settings_dark_mode_message">Select mode which best suits your style!</string>
+    <string name="settings_dark_mode_light">Always Light</string>
+    <string name="settings_dark_mode_system">Follow System</string>
+    <string name="settings_dark_mode_dark">Always Dark</string>
+    <string name="settings_download_path_title">Download path</string>
+    <string name="settings_download_path_message">Files will be saved to %1$s</string>
+    <string name="settings_hide_app_title">Hide the Magisk app</string>
+    <string name="settings_hide_app_summary">Install a proxy app with a random package ID and custom app label</string>
+    <string name="settings_restore_app_title">Restore the Magisk app</string>
+    <string name="settings_restore_app_summary">Unhide the app and restore the original APK</string>
+    <string name="language">Language</string>
+    <string name="system_default">(System Default)</string>
+    <string name="settings_check_update_title">Check Updates</string>
+    <string name="settings_check_update_summary">Periodically check for updates in the background</string>
+    <string name="settings_update_channel_title">Update Channel</string>
+    <string name="settings_update_stable">Stable</string>
+    <string name="settings_update_beta">Beta</string>
+    <string name="settings_update_custom">Custom</string>
+    <string name="settings_update_custom_msg">Insert a custom channel URL</string>
+    <string name="settings_zygisk_summary">Run parts of Magisk in the zygote daemon</string>
+    <string name="settings_denylist_title">Enforce DenyList</string>
+    <string name="settings_denylist_summary">Processes on the denylist will have all Magisk modifications reverted</string>
+    <string name="settings_denylist_error">This feature requires %1$s to be enabled</string>
+    <string name="settings_denylist_config_title">Configure DenyList</string>
+    <string name="settings_denylist_config_summary">Select the processes to be included on the denylist</string>
+    <string name="settings_hosts_title">Systemless hosts</string>
+    <string name="settings_hosts_summary">Systemless hosts support for ad blocking apps</string>
+    <string name="settings_hosts_toast">Added systemless hosts module</string>
+    <string name="settings_app_name_hint">New name</string>
+    <string name="settings_app_name_helper">App will be repackaged with this name</string>
+    <string name="settings_app_name_error">Invalid format</string>
+    <string name="settings_su_app_adb">Apps and ADB</string>
+    <string name="settings_su_app">Apps only</string>
+    <string name="settings_su_adb">ADB only</string>
+    <string name="settings_su_disable">Disabled</string>
+    <string name="settings_su_request_10">10 seconds</string>
+    <string name="settings_su_request_15">15 seconds</string>
+    <string name="settings_su_request_20">20 seconds</string>
+    <string name="settings_su_request_30">30 seconds</string>
+    <string name="settings_su_request_45">45 seconds</string>
+    <string name="settings_su_request_60">60 seconds</string>
+    <string name="superuser_access">Superuser Access</string>
+    <string name="auto_response">Automatic Response</string>
+    <string name="request_timeout">Request Timeout</string>
+    <string name="superuser_notification">Superuser Notification</string>
+    <string name="settings_su_reauth_title">Reauthenticate after upgrade</string>
+    <string name="settings_su_reauth_summary">Ask for Superuser permissions again after upgrading apps</string>
+    <string name="settings_su_tapjack_title">Tapjacking Protection</string>
+    <string name="settings_su_tapjack_summary">The Superuser prompt dialog will not respond to input while obscured by any other window or overlay</string>
+    <string name="settings_su_biometric_title">Biometric Authentication</string>
+    <string name="settings_su_biometric_summary">Use biometric authentication to allow Superuser requests</string>
+    <string name="no_biometric">Unsupported device or no biometric settings are enabled</string>
+    <string name="settings_customization">Customization</string>
+    <string name="setting_add_shortcut_summary">Add a pretty shortcut to the home screen in case the name and icon are difficult to recognize after hiding the app</string>
+    <string name="settings_doh_title">DNS over HTTPS</string>
+    <string name="settings_doh_description">Workaround DNS poisoning in some nations</string>
+
+    <string name="multiuser_mode">Multiuser Mode</string>
+    <string name="settings_owner_only">Device Owner Only</string>
+    <string name="settings_owner_manage">Device Owner Managed</string>
+    <string name="settings_user_independent">User-Independent</string>
+    <string name="owner_only_summary">Only owner has root access</string>
+    <string name="owner_manage_summary">Only owner can manage root access and receive request prompts</string>
+    <string name="user_independent_summary">Each user has their own separate root rules</string>
+
+    <string name="mount_namespace_mode">Mount Namespace Mode</string>
+    <string name="settings_ns_global">Global Namespace</string>
+    <string name="settings_ns_requester">Inherit Namespace</string>
+    <string name="settings_ns_isolate">Isolated Namespace</string>
+    <string name="global_summary">All root sessions use the global mount namespace</string>
+    <string name="requester_summary">Root sessions will inherit their requester\'s namespace</string>
+    <string name="isolate_summary">Each root session will have its own isolated namespace</string>
+
+    <!--Notifications-->
+    <string name="update_channel">Magisk Updates</string>
+    <string name="progress_channel">Progress Notifications</string>
+    <string name="updated_channel">Update Complete</string>
+    <string name="download_complete">Download complete</string>
+    <string name="download_file_error">Error downloading file</string>
+    <string name="magisk_update_title">Magisk Update Available!</string>
+    <string name="updated_title">Magisk Updated</string>
+    <string name="updated_text">Tap to open app</string>
+
+    <!--Toasts, Dialogs-->
+    <string name="yes">Yes</string>
+    <string name="no">No</string>
+    <string name="repo_install_title">Install %1$s %2$s(%3$d)</string>
+    <string name="download">Download</string>
+    <string name="reboot">Reboot</string>
+    <string name="release_notes">Release notes</string>
+    <string name="flashing">Flashing…</string>
+    <string name="done">Done!</string>
+    <string name="failure">Failed!</string>
+    <string name="hide_app_title">Hiding the Magisk app…</string>
+    <string name="open_link_failed_toast">No app found to open the link</string>
+    <string name="complete_uninstall">Complete Uninstall</string>
+    <string name="restore_img">Restore Images</string>
+    <string name="restore_img_msg">Restoring…</string>
+    <string name="restore_done">Restoration done!</string>
+    <string name="restore_fail">Stock backup does not exist!</string>
+    <string name="setup_fail">Setup failed</string>
+    <string name="env_fix_title">Requires Additional Setup</string>
+    <string name="env_fix_msg">Your device needs additional setup for Magisk to work properly. Do you want to proceed and reboot?</string>
+    <string name="setup_msg">Running environment setup…</string>
+    <string name="authenticate">Authenticate</string>
+    <string name="unsupport_magisk_title">Unsupported Magisk Version</string>
+    <string name="unsupport_magisk_msg">This version of the app does not support Magisk versions lower than %1$s.\n\nThe app will behave as if no Magisk is installed, please upgrade Magisk as soon as possible.</string>
+    <string name="unsupport_general_title">Abnormal State</string>
+    <string name="unsupport_system_app_msg">Running this app as a system app is not supported. Please revert the app to a user app.</string>
+    <string name="unsupport_other_su_msg">A \"su\" binary not from Magisk has been detected. Please remove any competing root solution and/or reinstall Magisk.</string>
+    <string name="unsupport_external_storage_msg">Magisk is installed to external storage. Please move the app to internal storage.</string>
+    <string name="unsupport_nonroot_stub_msg">The hidden Magisk app cannot continue to work because root was lost. Please restore the original APK.</string>
+    <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
+    <string name="external_rw_permission_denied">Grant storage permission to enable this functionality</string>
+    <string name="install_unknown_denied">Allow "install unknown apps" to enable this functionality</string>
+    <string name="add_shortcut_title">Add shortcut to home screen</string>
+    <string name="add_shortcut_msg">After hiding this app, its name and icon might become difficult to recognize. Do you want to add a pretty shortcut to the home screen?</string>
+    <string name="app_not_found">No app found to handle this action</string>
+    <string name="reboot_apply_change">Reboot to apply changes</string>
+    <string name="restore_app_confirmation">This will restore the hidden app back to the original app. Do you really want to do this?</string>
+
+</resources>
diff --git a/build.py b/build.py
index bc174d71160e..d88b11834590 100755
--- a/build.py
+++ b/build.py
@@ -48,8 +48,8 @@ def vprint(str):
         no_color = True
 
 # Environment checks
-if not sys.version_info >= (3, 6):
-    error('Requires Python 3.6+')
+if not sys.version_info >= (3, 8):
+    error('Requires Python 3.8+')
 
 if 'ANDROID_SDK_ROOT' not in os.environ:
     error('Please add Android SDK path to ANDROID_SDK_ROOT environment variable!')
@@ -309,13 +309,7 @@ def binary_dump(src, var_name, compressor=xz):
 
 
 def dump_bin_header(args):
-    stub = op.join(config['outdir'], f'stub-{"release" if args.release else "debug"}.apk')
-    if not op.exists(stub):
-        error('Build stub APK before building "magiskinit"')
     mkdir_p(native_gen_path)
-    with open(stub, 'rb') as src:
-        text = binary_dump(src, 'manager_xz')
-        write_if_diff(op.join(native_gen_path, 'binaries.h'), text)
     for arch in archs:
         preload = op.join('native', 'out', arch, 'libinit-ld.so')
         with open(preload, 'rb') as src:
@@ -431,6 +425,14 @@ def build_app(args):
     header('* Building the Magisk app')
     build_apk(args, 'app')
 
+    # Stub building is directly integrated into the main app
+    # build process. Copy the stub APK into output directory.
+    build_type = 'release' if args.release else 'debug'
+    apk = f'stub-{build_type}.apk'
+    source = op.join('app', 'src', 'main', 'assets', 'stub.apk')
+    target = op.join(config['outdir'], apk)
+    cp(source, target)
+
 
 def build_stub(args):
     header('* Building the stub app')
@@ -455,6 +457,7 @@ def cleanup(args):
     if 'java' in args.target:
         header('* Cleaning java')
         execv([gradlew, 'app:clean', 'app:shared:clean', 'stub:clean'])
+        rm_rf(op.join('app', 'src', 'main', 'assets'))
 
 
 def setup_ndk(args):
@@ -554,7 +557,6 @@ def patch_avd_ramdisk(args):
 
 
 def build_all(args):
-    build_stub(args)
     build_binary(args)
     build_app(args)
 
diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index a2ec46cbc682..6a46db98b725 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -24,9 +24,9 @@ tasks.withType<KotlinCompile> {
 }
 
 dependencies {
-    implementation(kotlin("gradle-plugin", "1.7.10"))
+    implementation(kotlin("gradle-plugin", "1.7.21"))
     implementation("com.android.tools.build:gradle:7.3.1")
     implementation("androidx.navigation:navigation-safe-args-gradle-plugin:2.5.3")
     implementation("io.michaelrocks:paranoid-gradle-plugin:0.3.7")
-    implementation("org.eclipse.jgit:org.eclipse.jgit:6.2.0.202206071550-r")
+    implementation("org.eclipse.jgit:org.eclipse.jgit:6.4.0.202211300538-r")
 }
diff --git a/buildSrc/src/main/java/Setup.kt b/buildSrc/src/main/java/Setup.kt
index c579e57bfd3d..4eb49ffe6824 100644
--- a/buildSrc/src/main/java/Setup.kt
+++ b/buildSrc/src/main/java/Setup.kt
@@ -15,8 +15,7 @@ import org.gradle.api.tasks.Copy
 import org.gradle.api.tasks.Delete
 import org.gradle.api.tasks.StopExecutionException
 import org.gradle.api.tasks.Sync
-import org.gradle.kotlin.dsl.filter
-import org.gradle.kotlin.dsl.named
+import org.gradle.kotlin.dsl.*
 import org.jetbrains.kotlin.gradle.dsl.KotlinJvmOptions
 import java.io.ByteArrayInputStream
 import java.io.ByteArrayOutputStream
@@ -40,12 +39,12 @@ private fun BaseExtension.kotlinOptions(configure: Action<KotlinJvmOptions>) =
     }
 
 private val Project.android: BaseAppModuleExtension
-    get() = extensions.getByName("android") as BaseAppModuleExtension
+    get() = extensions["android"] as BaseAppModuleExtension
 
 fun Project.setupCommon() {
     androidBase {
         compileSdkVersion(33)
-        buildToolsVersion = "32.0.0"
+        buildToolsVersion = "33.0.1"
         ndkPath = "$sdkDirectory/ndk/magisk"
 
         defaultConfig {
@@ -112,14 +111,14 @@ private fun Project.setupAppCommon() {
         }
 
         buildTypes {
-            signingConfigs.getByName("config").also {
-                getByName("debug") {
+            signingConfigs["config"].also {
+                debug {
                     signingConfig = if (it.storeFile?.exists() == true) it
-                    else signingConfigs.getByName("debug")
+                    else signingConfigs["debug"]
                 }
-                getByName("release") {
+                release {
                     signingConfig = if (it.storeFile?.exists() == true) it
-                    else signingConfigs.getByName("debug")
+                    else signingConfigs["debug"]
                 }
             }
         }
@@ -147,7 +146,7 @@ private fun Project.setupAppCommon() {
 fun Project.setupApp() {
     setupAppCommon()
 
-    val syncLibs = tasks.register("syncLibs", Sync::class.java) {
+    val syncLibs by tasks.registering(Sync::class) {
         into("src/main/jniLibs")
         into("armeabi-v7a") {
             from(rootProject.file("native/out/armeabi-v7a")) {
@@ -180,35 +179,8 @@ fun Project.setupApp() {
         }
     }
 
-    val syncAssets = tasks.register("syncAssets", Sync::class.java) {
+    val syncResources by tasks.registering(Sync::class) {
         dependsOn(syncLibs)
-        inputs.property("version", Config.version)
-        inputs.property("versionCode", Config.versionCode)
-        into("src/main/assets")
-        from(rootProject.file("scripts")) {
-            include("util_functions.sh", "boot_patch.sh", "addon.d.sh")
-            include("uninstaller.sh", "module_installer.sh")
-        }
-        from(rootProject.file("tools/bootctl"))
-        into("chromeos") {
-            from(rootProject.file("tools/futility"))
-            from(rootProject.file("tools/keys")) {
-                include("kernel_data_key.vbprivk", "kernel.keyblock")
-            }
-        }
-        filesMatching("**/util_functions.sh") {
-            filter {
-                it.replace(
-                    "#MAGISK_VERSION_STUB",
-                    "MAGISK_VER='${Config.version}'\nMAGISK_VER_CODE=${Config.versionCode}"
-                )
-            }
-            filter<FixCrLfFilter>("eol" to FixCrLfFilter.CrLf.newInstance("lf"))
-        }
-    }
-
-    val syncResources = tasks.register("syncResources", Sync::class.java) {
-        dependsOn(syncAssets)
         into("src/main/resources/META-INF/com/google/android")
         from(rootProject.file("scripts/update_binary.sh")) {
             rename { "update-binary" }
@@ -220,22 +192,43 @@ fun Project.setupApp() {
 
     android.applicationVariants.all {
         val variantCapped = name.capitalize(Locale.ROOT)
-        val variantLowered = name.toLowerCase(Locale.ROOT)
 
-        val copyStub = tasks.register("copy${variantCapped}StubApk", Copy::class.java) {
-            dependsOn(syncResources)
+        val stubTask = tasks.getByPath(":stub:package$variantCapped")
+        val stubApk = stubTask.outputs.files.asFileTree.filter {
+            it.name.endsWith(".apk")
+        }
+
+        val syncAssets = tasks.register("sync${variantCapped}Assets", Sync::class) {
+            dependsOn(syncResources, stubTask)
+            inputs.property("version", Config.version)
+            inputs.property("versionCode", Config.versionCode)
             into("src/main/assets")
-            from(rootProject.file("out/stub-${variantLowered}.apk")) {
+            from(rootProject.file("scripts")) {
+                include("util_functions.sh", "boot_patch.sh", "addon.d.sh")
+                include("uninstaller.sh", "module_installer.sh")
+            }
+            from(rootProject.file("tools/bootctl"))
+            into("chromeos") {
+                from(rootProject.file("tools/futility"))
+                from(rootProject.file("tools/keys")) {
+                    include("kernel_data_key.vbprivk", "kernel.keyblock")
+                }
+            }
+            from(stubApk) {
                 rename { "stub.apk" }
             }
-            onlyIf {
-                if (inputs.sourceFiles.files.size != 1)
-                    throw StopExecutionException("Please build stub first! (./build.py stub)")
-                true
+            filesMatching("**/util_functions.sh") {
+                filter {
+                    it.replace(
+                        "#MAGISK_VERSION_STUB",
+                        "MAGISK_VER='${Config.version}'\nMAGISK_VER_CODE=${Config.versionCode}"
+                    )
+                }
+                filter<FixCrLfFilter>("eol" to FixCrLfFilter.CrLf.newInstance("lf"))
             }
         }
 
-        preBuildProvider.get().dependsOn(copyStub)
+        preBuildProvider.get().dependsOn(syncAssets)
 
         val keysDir = rootProject.file("tools/keys")
         val outSrcDir = File(buildDir, "generated/source/keydata/$name")
diff --git a/docs/guides.md b/docs/guides.md
index d814f84b2c40..b13134a849e1 100644
--- a/docs/guides.md
+++ b/docs/guides.md
@@ -257,7 +257,7 @@ Since `/` is read-only on system-as-root devices, Magisk provides an overlay sys
 
 Overlay files shall be placed in the `overlay.d` folder in boot image ramdisk, and they follow these rules:
 
-1. All `*.rc` files in `overlay.d` will be read and concatenated **AFTER** `init.rc`
+1. Each `*.rc` file (except for `init.rc`) in `overlay.d` will be read and concatenated **AFTER** `init.rc` if it does not exist in the root directory, otherwise it will **REPLACE** the existing one.
 2. Existing files can be replaced by files located at the same relative path
 3. Files that correspond to a non-existing file will be ignored
 
diff --git a/gradle.properties b/gradle.properties
index 99d48d9c0fd5..36be6597e2b3 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -28,5 +28,5 @@ android.nonTransitiveRClass=true
 
 # Magisk
 magisk.stubVersion=34
-magisk.versionCode=25205
+magisk.versionCode=25206
 magisk.ondkVersion=r25.2
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 249e5832f090..943f0cbfa754 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 8fad3f5a98bf..2b22d057a071 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6-all.zip
+networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index a69d9cb6c206..65dcd68d65c8 100755
--- a/gradlew
+++ b/gradlew
@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -80,10 +80,10 @@ do
     esac
 done
 
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-APP_NAME="Gradle"
+# This is normally unused
+# shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
 
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
@@ -143,12 +143,16 @@ fi
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045 
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
     case $MAX_FD in  #(
       '' | soft) :;; #(
       *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045 
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
diff --git a/gradlew.bat b/gradlew.bat
index f127cfd49d40..93e3f59f135d 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -26,6 +26,7 @@ if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
diff --git a/native/src/base/include/embed.hpp b/native/src/base/include/embed.hpp
index 41250240e1e9..c34394a5572a 100644
--- a/native/src/base/include/embed.hpp
+++ b/native/src/base/include/embed.hpp
@@ -1,5 +1,3 @@
-#include <binaries.h>
-
 #if defined(__arm__)
 #include <armeabi-v7a_binaries.h>
 #elif defined(__aarch64__)
diff --git a/native/src/core/bootstages.cpp b/native/src/core/bootstages.cpp
index 8908a0750f5c..3a391aebe68d 100644
--- a/native/src/core/bootstages.cpp
+++ b/native/src/core/bootstages.cpp
@@ -17,7 +17,17 @@
 
 using namespace std;
 
-static bool safe_mode = false;
+// Boot stage state
+enum : int {
+    FLAG_NONE = 0,
+    FLAG_POST_FS_DATA_DONE = (1 << 0),
+    FLAG_LATE_START_DONE = (1 << 1),
+    FLAG_BOOT_COMPLETE = (1 << 2),
+    FLAG_SAFE_MODE = (1 << 3),
+};
+
+static int boot_state = FLAG_NONE;
+
 bool zygisk_enabled = false;
 
 /*********
@@ -272,21 +282,15 @@ static bool check_key_combo() {
  * Boot Stage Handlers *
  ***********************/
 
-static pthread_mutex_t stage_lock = PTHREAD_MUTEX_INITIALIZER;
 extern int disable_deny();
 
-void post_fs_data(int client) {
-    close(client);
-
-    mutex_guard lock(stage_lock);
-
+static void post_fs_data() {
     if (getenv("REMOUNT_ROOT"))
         xmount(nullptr, "/", nullptr, MS_REMOUNT | MS_RDONLY, nullptr);
 
     if (!check_data())
-        goto unblock_init;
+        return;
 
-    DAEMON_STATE = STATE_POST_FS_DATA;
     setup_logfile(true);
 
     LOGI("** post-fs-data mode running\n");
@@ -313,8 +317,9 @@ void post_fs_data(int client) {
         goto early_abort;
     }
 
-    if (getprop("persist.sys.safemode", true) == "1" || check_key_combo()) {
-        safe_mode = true;
+    if (getprop("persist.sys.safemode", true) == "1" ||
+        getprop("ro.sys.safemode") == "1" || check_key_combo()) {
+        boot_state |= FLAG_SAFE_MODE;
         // Disable all modules and denylist so next boot will be clean
         disable_modules();
         disable_deny();
@@ -330,40 +335,26 @@ void post_fs_data(int client) {
 early_abort:
     // We still do magic mount because root itself might need it
     magic_mount();
-    DAEMON_STATE = STATE_POST_FS_DATA_DONE;
-
-unblock_init:
-    close(xopen(UNBLOCKFILE, O_RDONLY | O_CREAT, 0));
+    boot_state |= FLAG_POST_FS_DATA_DONE;
 }
 
-void late_start(int client) {
-    close(client);
-
-    mutex_guard lock(stage_lock);
-    run_finally fin([]{ DAEMON_STATE = STATE_LATE_START_DONE; });
+static void late_start() {
     setup_logfile(false);
 
     LOGI("** late_start service mode running\n");
 
-    if (DAEMON_STATE < STATE_POST_FS_DATA_DONE || safe_mode)
-        return;
-
     exec_common_scripts("service");
     exec_module_scripts("service");
-}
 
-void boot_complete(int client) {
-    close(client);
+    boot_state |= FLAG_LATE_START_DONE;
+}
 
-    mutex_guard lock(stage_lock);
-    DAEMON_STATE = STATE_BOOT_COMPLETE;
+static void boot_complete() {
+    boot_state |= FLAG_BOOT_COMPLETE;
     setup_logfile(false);
 
     LOGI("** boot-complete triggered\n");
 
-    if (safe_mode)
-        return;
-
     // At this point it's safe to create the folder
     if (access(SECURE_DIR, F_OK) != 0)
         xmkdir(SECURE_DIR, 0700);
@@ -373,10 +364,26 @@ void boot_complete(int client) {
     get_manager(0, nullptr, true);
 }
 
-void zygote_restart(int client) {
-    close(client);
+void boot_stage_handler(int code) {
+    // Make sure boot stage execution is always serialized
+    static pthread_mutex_t stage_lock = PTHREAD_MUTEX_INITIALIZER;
+    mutex_guard lock(stage_lock);
 
-    LOGI("** zygote restarted\n");
-    pkg_xml_ino = 0;
-    prune_su_access();
+    switch (code) {
+    case MainRequest::POST_FS_DATA:
+        if ((boot_state & FLAG_POST_FS_DATA_DONE) == 0)
+            post_fs_data();
+        close(xopen(UNBLOCKFILE, O_RDONLY | O_CREAT, 0));
+        break;
+    case MainRequest::LATE_START:
+        if ((boot_state & FLAG_POST_FS_DATA_DONE) && (boot_state & FLAG_SAFE_MODE) == 0)
+            late_start();
+        break;
+    case MainRequest::BOOT_COMPLETE:
+        if ((boot_state & FLAG_SAFE_MODE) == 0)
+            boot_complete();
+        break;
+    default:
+        __builtin_unreachable();
+    }
 }
diff --git a/native/src/core/core.hpp b/native/src/core/core.hpp
index 598d953398eb..efa7c9ee11f9 100644
--- a/native/src/core/core.hpp
+++ b/native/src/core/core.hpp
@@ -4,18 +4,8 @@
 #include <vector>
 
 extern bool RECOVERY_MODE;
-extern int DAEMON_STATE;
 extern std::atomic<ino_t> pkg_xml_ino;
 
-// Daemon state
-enum : int {
-    STATE_NONE,
-    STATE_POST_FS_DATA,
-    STATE_POST_FS_DATA_DONE,
-    STATE_LATE_START_DONE,
-    STATE_BOOT_COMPLETE
-};
-
 void unlock_blocks();
 void reboot();
 void start_log_daemon();
diff --git a/native/src/core/daemon.cpp b/native/src/core/daemon.cpp
index b30a73650805..f5626a9b7f7f 100644
--- a/native/src/core/daemon.cpp
+++ b/native/src/core/daemon.cpp
@@ -21,7 +21,6 @@ int SDK_INT = -1;
 string MAGISKTMP;
 
 bool RECOVERY_MODE = false;
-int DAEMON_STATE = STATE_NONE;
 
 static struct stat self_st;
 
@@ -143,17 +142,11 @@ static void handle_request_async(int client, int code, const sock_cred &cred) {
     case MainRequest::SUPERUSER:
         su_daemon_handler(client, &cred);
         break;
-    case MainRequest::POST_FS_DATA:
-        post_fs_data(client);
-        break;
-    case MainRequest::LATE_START:
-        late_start(client);
-        break;
-    case MainRequest::BOOT_COMPLETE:
-        boot_complete(client);
-        break;
     case MainRequest::ZYGOTE_RESTART:
-        zygote_restart(client);
+        close(client);
+        LOGI("** zygote restarted\n");
+        pkg_xml_ino = 0;
+        prune_su_access();
         break;
     case MainRequest::SQLITE_CMD:
         exec_sql(client);
@@ -232,7 +225,9 @@ static void handle_request(pollfd *pfd) {
     }
 
     code = read_int(client);
-    if (code < 0 || code >= MainRequest::END || code == MainRequest::_SYNC_BARRIER_) {
+    if (code < 0 || code >= MainRequest::END ||
+        code == MainRequest::_SYNC_BARRIER_ ||
+        code == MainRequest::_STAGE_BARRIER_) {
         // Unknown request code
         goto done;
     }
@@ -274,10 +269,12 @@ static void handle_request(pollfd *pfd) {
     if (code < MainRequest::_SYNC_BARRIER_) {
         handle_request_sync(client, code);
         goto done;
+    } else if (code < MainRequest::_STAGE_BARRIER_) {
+        exec_task([=] { handle_request_async(client, code, cred); });
+    } else {
+        close(client);
+        exec_task([=] { boot_stage_handler(code); });
     }
-
-    // Handle async requests in another thread
-    exec_task([=] { handle_request_async(client, code, cred); });
     return;
 
 done:
diff --git a/native/src/core/module.cpp b/native/src/core/module.cpp
index 6967cf51f702..330b26fa8a23 100644
--- a/native/src/core/module.cpp
+++ b/native/src/core/module.cpp
@@ -117,7 +117,7 @@ class dir_node : public node_entry {
     // Return false to indicate need to upgrade to module
     bool collect_files(const char *module, int dfd);
 
-    // Return false to indicate need to upgrade to skeleton
+    // Return true to indicate need to upgrade to skeleton
     bool prepare();
 
     // Default directory mount logic
@@ -422,14 +422,14 @@ bool dir_node::prepare() {
                 }
             }
         }
-        if (auto dn = dyn_cast<dir_node>(it->second); dn && dn->is_dir() && !dn->prepare()) {
+        if (auto dn = dyn_cast<dir_node>(it->second); dn && dn->is_dir() && dn->prepare()) {
             // Upgrade child to tmpfs
             it = upgrade<tmpfs_node>(it);
         }
 next_node:
         ++it;
     }
-    return !to_tmpfs;
+    return to_tmpfs;
 }
 
 bool dir_node::collect_files(const char *module, int dfd) {
diff --git a/native/src/include/daemon.hpp b/native/src/include/daemon.hpp
index 6c5b436e3617..b2d812714204 100644
--- a/native/src/include/daemon.hpp
+++ b/native/src/include/daemon.hpp
@@ -31,15 +31,19 @@ enum : int {
     _SYNC_BARRIER_,
 
     SUPERUSER,
-    POST_FS_DATA,
-    LATE_START,
-    BOOT_COMPLETE,
     ZYGOTE_RESTART,
     DENYLIST,
     SQLITE_CMD,
     REMOVE_MODULES,
     ZYGISK,
     ZYGISK_PASSTHROUGH,
+
+    _STAGE_BARRIER_,
+
+    POST_FS_DATA,
+    LATE_START,
+    BOOT_COMPLETE,
+
     END,
 };
 }
@@ -84,10 +88,7 @@ extern std::atomic<int> logd_fd;
 extern "C" void magisk_log_write(int prio, const char *msg, int len);
 
 // Daemon handlers
-void post_fs_data(int client);
-void late_start(int client);
-void boot_complete(int client);
-void zygote_restart(int client);
+void boot_stage_handler(int code);
 void denylist_handler(int client, const sock_cred *cred);
 void su_daemon_handler(int client, const sock_cred *cred);
 void zygisk_handler(int client, const sock_cred *cred);
diff --git a/native/src/init/init.cpp b/native/src/init/init.cpp
index 33f59bcec540..8417bd67e847 100644
--- a/native/src/init/init.cpp
+++ b/native/src/init/init.cpp
@@ -61,10 +61,6 @@ void restore_ramdisk_init() {
     }
 }
 
-int dump_manager(const char *path, mode_t mode) {
-    return dump_bin(manager_xz, sizeof(manager_xz), path, mode);
-}
-
 int dump_preload(const char *path, mode_t mode) {
     return dump_bin(init_ld_xz, sizeof(init_ld_xz), path, mode);
 }
@@ -87,12 +83,6 @@ int main(int argc, char *argv[]) {
     if (name == "magisk"sv)
         return magisk_proxy_main(argc, argv);
 
-    if (argc > 1 && argv[1] == "-x"sv) {
-        if (argc > 2 && argv[2] == "manager"sv)
-            return dump_manager(argv[3], 0644);
-        return 1;
-    }
-
     if (getpid() != 1)
         return 1;
 
diff --git a/native/src/init/init.hpp b/native/src/init/init.hpp
index 1e1125488093..3d9c95bc0917 100644
--- a/native/src/init/init.hpp
+++ b/native/src/init/init.hpp
@@ -36,7 +36,6 @@ bool check_two_stage();
 void setup_klog();
 const char *backup_init();
 void restore_ramdisk_init();
-int dump_manager(const char *path, mode_t mode);
 int dump_preload(const char *path, mode_t mode);
 
 /***************
diff --git a/native/src/init/rootdir.cpp b/native/src/init/rootdir.cpp
index 65e3e02011b3..bb495777c419 100644
--- a/native/src/init/rootdir.cpp
+++ b/native/src/init/rootdir.cpp
@@ -68,8 +68,18 @@ static void load_overlay_rc(const char *overlay) {
     int dfd = dirfd(dir.get());
     // Do not allow overwrite init.rc
     unlinkat(dfd, "init.rc", 0);
+
+    // '/' + name + '\0'
+    char buf[NAME_MAX + 2];
+    buf[0] = '/';
     for (dirent *entry; (entry = xreaddir(dir.get()));) {
-        if (str_ends(entry->d_name, ".rc")) {
+        if (!str_ends(entry->d_name, ".rc")) {
+            continue;
+        }
+        strscpy(buf + 1, entry->d_name, sizeof(buf) - 1);
+        if (access(buf, F_OK) == 0) {
+            LOGD("Replace rc script [%s]\n", entry->d_name);
+        } else {
             LOGD("Found rc script [%s]\n", entry->d_name);
             int rc = xopenat(dfd, entry->d_name, O_RDONLY | O_CLOEXEC);
             rc_list.push_back(full_read(rc));
@@ -141,6 +151,7 @@ static void patch_socket_name(const char *path) {
 static void extract_files(bool sbin) {
     const char *m32 = sbin ? "/sbin/magisk32.xz" : "magisk32.xz";
     const char *m64 = sbin ? "/sbin/magisk64.xz" : "magisk64.xz";
+    const char *stub_xz = sbin ? "/sbin/stub.xz" : "stub.xz";
 
     if (access(m32, F_OK) == 0) {
         auto magisk = mmap_data(m32);
@@ -161,8 +172,13 @@ static void extract_files(bool sbin) {
     } else {
         xsymlink("./magisk32", "magisk");
     }
-
-    dump_manager("stub.apk", 0);
+    if (access(stub_xz, F_OK) == 0) {
+        auto stub = mmap_data(stub_xz);
+        unlink(stub_xz);
+        int fd = xopen("stub.apk", O_WRONLY | O_CREAT, 0);
+        unxz(fd, stub.buf, stub.sz);
+        close(fd);
+    }
 }
 
 #define ROOTMIR     MIRRDIR "/system_root"
diff --git a/native/src/init/twostage.cpp b/native/src/init/twostage.cpp
index 64a6c28cee10..e7fd1ee3123c 100644
--- a/native/src/init/twostage.cpp
+++ b/native/src/init/twostage.cpp
@@ -26,6 +26,7 @@ void LegacySARInit::first_stage_prep() {
         write(dest, init.buf, init.sz);
         fclone_attr(src, dest);
         close(dest);
+        close(src);
     }
     xmount("/data/init", "/init", nullptr, MS_BIND, nullptr);
 }
diff --git a/scripts/avd_magisk.sh b/scripts/avd_magisk.sh
index d8b65471ae02..9ea7f86313cf 100755
--- a/scripts/avd_magisk.sh
+++ b/scripts/avd_magisk.sh
@@ -48,7 +48,7 @@ fi
 pm install -r $(pwd)/magisk.apk
 
 # Extract files from APK
-unzip -oj magisk.apk 'assets/util_functions.sh'
+unzip -oj magisk.apk 'assets/util_functions.sh' 'assets/stub.apk'
 . ./util_functions.sh
 
 api_level_arch_detect
@@ -124,7 +124,7 @@ mkdir $NVBASE/modules 2>/dev/null
 mkdir $POSTFSDATAD 2>/dev/null
 mkdir $SERVICED 2>/dev/null
 
-for file in magisk32 magisk64 magiskpolicy; do
+for file in magisk32 magisk64 magiskpolicy stub.apk; do
   chmod 755 ./$file
   cp -af ./$file $MAGISKTMP/$file
   cp -af ./$file $MAGISKBIN/$file
@@ -143,8 +143,6 @@ ln -s ./magisk $MAGISKTMP/resetprop
 ln -s ./magisk $MAGISKTMP/magiskhide
 ln -s ./magiskpolicy $MAGISKTMP/supolicy
 
-./magiskinit -x manager $MAGISKTMP/stub.apk
-
 mkdir -p $MAGISKTMP/.magisk/mirror
 mkdir $MAGISKTMP/.magisk/block
 touch $MAGISKTMP/.magisk/config
diff --git a/scripts/avd_patch.sh b/scripts/avd_patch.sh
index e787953ca0f8..268b4decb5f9 100644
--- a/scripts/avd_patch.sh
+++ b/scripts/avd_patch.sh
@@ -43,7 +43,7 @@ if [ -z "$FIRST_STAGE" ]; then
 fi
 
 # Extract files from APK
-unzip -oj magisk.apk 'assets/util_functions.sh'
+unzip -oj magisk.apk 'assets/util_functions.sh' 'assets/stub.apk'
 . ./util_functions.sh
 
 api_level_arch_detect
@@ -65,6 +65,7 @@ touch config
 
 ./magiskboot compress=xz magisk32 magisk32.xz
 ./magiskboot compress=xz magisk64 magisk64.xz
+./magiskboot compress=xz stub.apk stub.xz
 
 export KEEPVERITY=false
 export KEEPFORCEENCRYPT=true
@@ -75,10 +76,11 @@ export KEEPFORCEENCRYPT=true
 "mkdir 0750 overlay.d/sbin" \
 "add 0644 overlay.d/sbin/magisk32.xz magisk32.xz" \
 "add 0644 overlay.d/sbin/magisk64.xz magisk64.xz" \
+"add 0644 overlay.d/sbin/stub.xz stub.xz" \
 "patch" \
 "backup ramdisk.cpio.orig" \
 "mkdir 000 .backup" \
 "add 000 .backup/.magisk config"
 
-rm -f ramdisk.cpio.orig config magisk*.xz
+rm -f ramdisk.cpio.orig config magisk*.xz stub.xz
 ./magiskboot compress=gzip ramdisk.cpio ramdisk.cpio.gz
diff --git a/scripts/boot_patch.sh b/scripts/boot_patch.sh
index c334e8d84dc6..068097c38e45 100644
--- a/scripts/boot_patch.sh
+++ b/scripts/boot_patch.sh
@@ -6,7 +6,7 @@
 # Usage: boot_patch.sh <bootimage>
 #
 # The following flags can be set in environment variables:
-# KEEPVERITY, KEEPFORCEENCRYPT, RECOVERYMODE
+# KEEPVERITY, KEEPFORCEENCRYPT, PATCHVBMETAFLAG, RECOVERYMODE
 #
 # This script should be placed in a directory with the following files:
 #
@@ -14,12 +14,13 @@
 #
 # boot_patch.sh      script    A script to patch boot image for Magisk.
 #                  (this file) The script will use files in its same
-#                              directory to complete the patching process
+#                              directory to complete the patching process.
 # util_functions.sh  script    A script which hosts all functions required
-#                              for this script to work properly
-# magiskinit         binary    The binary to replace /init
-# magisk(32/64)      binary    The magisk binaries
-# magiskboot         binary    A tool to manipulate boot images
+#                              for this script to work properly.
+# magiskinit         binary    The binary to replace /init.
+# magisk(32/64)      binary    The magisk binaries.
+# magiskboot         binary    A tool to manipulate boot images.
+# stub.apk           binary    The stub Magisk app to embed into ramdisk.
 # chromeos           folder    This folder includes the utility and keys to sign
 #                  (optional)  chromeos boot images. Only used for Pixel C.
 #
@@ -164,6 +165,7 @@ if [ -f magisk64 ]; then
   ./magiskboot compress=xz magisk64 magisk64.xz
   unset SKIP64
 fi
+./magiskboot compress=xz stub.apk stub.xz
 
 ./magiskboot cpio ramdisk.cpio \
 "add 0750 $INIT magiskinit" \
@@ -171,12 +173,13 @@ fi
 "mkdir 0750 overlay.d/sbin" \
 "$SKIP32 add 0644 overlay.d/sbin/magisk32.xz magisk32.xz" \
 "$SKIP64 add 0644 overlay.d/sbin/magisk64.xz magisk64.xz" \
+"add 0644 overlay.d/sbin/stub.xz stub.xz" \
 "patch" \
 "backup ramdisk.cpio.orig" \
 "mkdir 000 .backup" \
 "add 000 .backup/.magisk config"
 
-rm -f ramdisk.cpio.orig config magisk*.xz
+rm -f ramdisk.cpio.orig config magisk*.xz stub.xz
 
 #################
 # Binary Patches
diff --git a/scripts/flash_script.sh b/scripts/flash_script.sh
index b6e8275ef32a..7e449cc973df 100644
--- a/scripts/flash_script.sh
+++ b/scripts/flash_script.sh
@@ -57,8 +57,6 @@ cd $BINDIR
 for file in lib*.so; do mv "$file" "${file:3:${#file}-6}"; done
 cd /
 cp -af $INSTALLER/lib/$ABI32/libmagisk32.so $BINDIR/magisk32 2>/dev/null
-cp -af $CHROMEDIR/. $BINDIR/chromeos
-chmod -R 755 $BINDIR
 
 # Check if system root is installed and remove
 $BOOTMODE || remove_system_su
@@ -73,6 +71,11 @@ ui_print "- Constructing environment"
 rm -rf $MAGISKBIN/* 2>/dev/null
 mkdir -p $MAGISKBIN 2>/dev/null
 cp -af $BINDIR/. $COMMONDIR/. $BBBIN $MAGISKBIN
+
+# Remove files only used by the Magisk app
+rm -f $MAGISKBIN/bootctl $MAGISKBIN/main.jar \
+  $MAGISKBIN/module_installer.sh $MAGISKBIN/uninstaller.sh
+
 chmod -R 755 $MAGISKBIN
 
 # addon.d
diff --git a/stub/src/main/res/values-sw/strings.xml b/stub/src/main/res/values-sw/strings.xml
new file mode 100644
index 000000000000..542cebcb308d
--- /dev/null
+++ b/stub/src/main/res/values-sw/strings.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="upgrade_msg">Pata toleo jipya la Magisk kamili ili kumaliza usanidi. Pakua na usakinishe?</string>
+    <string name="no_internet_msg">Tafadhali unganisha kwenye Mtandao! Kusasisha hadi Magisk kamili inahitajika.</string>
+    <string name="dling">Inapakua</string>
+    <string name="relaunch_app">Tafadhali zindua upya programu wewe mwenyewe</string>
+</resources>